Descrição
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Software
Não informado
Tipo Software
Plugin
CVE
CVE-2020-36156
Tags
Nâo informado
Data de publicação
04/01/2021
Última atualização
24/02/2022
Pontuação em CVSS 3.0
8.8
Alto